InfoSecBulletin Cybersecurity for mankind
Microsoft has released patches for two critical security flaws in Azure AI Face Service and Microsoft Account that could allow an attacker to escalate their privileges.
The flaws are listed below:
UK Software Firm Exposed 8 million of Healthcare Worker Records
GitHub Enterprise Server Vulns Expose Risk of Code Execution
CVE-2025-2492
ASUS warns of critical auth bypass flaw in routers
16,000+ Fortinet devices compromised with symlink backdoor, Mostly in Asia
Patch now! Critical Erlang/OTP SSH Vuln Allows UCE
CISA warns of increasing risk tied to Oracle legacy Cloud leak
CVE-2025-20236
Cisco Patches Unauthenticated RCE Flaw in Webex App
Apple released emergency security updates for 2 zero-day vulns
Oracle Released Patched for 378 flaws for April 2025
CVE-2025-24054
Hackers Exploiting NTLM Spoofing Windows Vuln the in Wild
CVE-2025-21396 (CVSS score: 7.5) – Microsoft Account Elevation of Privilege Vulnerability
CVE-2025-21415 (CVSS score: 9.9) – Azure AI Face Service Elevation of Privilege Vulnerability
“Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network,” Microsoft in an advisory for CVE-2025-21415, crediting an anonymous researcher for reporting the flaw.
CVE-2025-21396 is a security vulnerability caused by a lack of authorization, allowing unauthorized users to gain elevated privileges on a network. It was discovered by security researcher Sugobet.
The tech giant acknowledged a proof-of-concept exploit for CVE-2025-21415 but confirmed that both vulnerabilities have been fully addressed, requiring no action from customers.
Microsoft is improving transparency by issuing CVEs for critical cloud service vulnerabilities, regardless of whether customers need to apply a patch or take other actions for security.
“As our industry matures and increasingly migrates to cloud-based services, we must be transparent about significant cybersecurity vulnerabilities that are found and fixed,” it noted back in June 2024.
“By openly sharing information about vulnerabilities that are discovered and resolved, we enable Microsoft and our partners to learn and improve. This collaborative effort contributes to the safety and resilience of our critical infrastructure.”
